The models are defined within the authentication-jwt extension. Here are the models: https://github.com/strongloop/loopback-next/tree/master/extensions/authentication-jwt/src/models. You can also customize the models if you wish, see https://github.com/strongloop/loopback-next/tree/master/extensions/authentication-jwt#customization for more details. Hope it helps.